Missing authorization check in CRM_THTMLB_LOAD_CSS leads to arbitrary read of reports source code
September 17, 2026
Missing authorization check in CRM_THTMLB_LOAD_CSS leads to arbitrary read of reports source code
Impact on Business
A remote, authenticated attacker can read the source code of arbitrary reports from the application server. This has a low impact on the confidentiality of the system and its business applications, potentially exposing sensitive logic or information embedded in the code.
Vulnerability Details
Within the SAP ABAP component SAP Web UI Framework (WEBCUIF), the remote-enabled function module CRM_THTMLB_LOAD_CSS does not perform adequate authorization checks. This allows an authenticated attacker with privileges to execute RFC functions to read the source code of any report present in the system. Consequently, an attacker may abuse this function to extract information from arbitrary programs, impacting the confidentiality of the system.
Solution
SAP has released SAP Note 3467377 which provides patched versions of the affected components.
The patches can be downloaded from https://me.sap.com/notes/3467377.
Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.
Report Timeline
- 04/10/2024: Onapsis reports vulnerability to SAP
- 07/09/2024: SAP issues the patch
References
Advisory Information
- Public Release Date: 09/17/2026
- Security Advisory ID: ONAPSIS-2026-0081
- Researcher(s): Pablo Artuso
Vulnerability Information
- Vendor: SAP
- Affected Components: SAP Web UI Framework (WEBCUIF) (Check SAP Note 3467377 for detailed information on affected releases)
- Vulnerability Class: CWE-862: Missing Authorization
- CVSS v3 score: 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- Risk Level: Medium
- Assigned CVE: CVE-2024-37175
- Vendor patch Information: SAP Security NOTE 3467377
Affected Components Description
- SAP Web UI Framework (WEBCUIF) Release 748
About our Research Labs
Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications. Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.
Find all reported vulnerabilities at: https://github.com/Onapsis/vulnerability_advisories
This advisory is licensed under a Creative Commons 4.0 BY-ND International License